Legal
Privacy Notice
Last updated: 10 July 2026
This Privacy Notice explains who we are, how we collect, share and use personal data about you and how you can exercise your privacy rights. This Privacy Notice applies to personal data that we collect through our website at hwbtplus.com (the "Website") and our online application (the "App"). We recommend that you read this Privacy Notice in full to ensure you are completely informed about your personal data.
Who collects the data?
HWBT Plus LTD ("HWBT") is the ‘controller’ of the personal data and gathers and uses certain data about you. HWBT is headquartered in the UK and operates an online platform that enables users to participate in competitions and prize draws.
If you have any questions about HWBT or about our use of your personal data, then please contact us using the contact details under the ‘How to contact us’ section below.
↑ Back to topPersonal data we collect and process
The personal data we collect from you, either directly or indirectly, will depend on how you interact with us and with our Website and App. We collect personal data about you from the following different sources:
Information that you provide directly
We collect personal data directly from you when you choose to provide us with this information through the Website or App, and through your other interactions with us or other uses on the Website or App (such as data collected via customer service communications, when uploading content, and posting comments and forum posts). Certain parts of our Website and App will ask you to provide personal data when you engage with the following: account and profile creation, purchasing entries or tokens, participating in competitions and prize draws, claiming or collecting prizes, subscribing to marketing communications, when undertaking promotional activities and contacting customer support.
Information that we collect indirectly
We collect your personal data indirectly, including through automated means from your device when you use our Website and App. Some of the information we collect indirectly is captured using cookies and other tracking technologies.
Information from third parties
We also collect your personal data from third party sources, i.e. our service providers that provide operational assistance, email, marketing and analytics services, as well as financial and credit related services and payment services.
The table below describes the categories of personal data we collect from and about you through our online services and activities on our Website and App.
| Personal data | Source |
|---|---|
| Identity and Contact Data — such as your name, email address, telephone number and address. | Directly from you (online or offline) · Indirectly from you · Third parties |
| Account Data — such as your login information (email and password) and account information (contact details including your name, surname, postcode, telephone number and country), birthday, handle and membership status (subscriber, non-subscriber, admin). | Directly from you · Indirectly from you · Third parties |
| Competition and Participation Data — such as the competitions you have entered, the entry method (paid or free entry route), transaction reference for entries, entry history and outcomes (e.g. wins, losses) and entry codes. | Directly from you (online or offline) · Indirectly from you |
| Winner and Promotional Data — such as information relating to your participation as a winner of a competition, including your name, username, hometown, prize details, photographs, images, audio recordings, video recordings, statements, interviews and other promotional content featuring you. | Directly from you (online or offline) · Indirectly from you · Third parties |
| Wallet and Token Data — such as your token balance, token transactions, redemption history and token usage. | Indirectly from you |
| Transaction Data — such as truncated credit or debit card details, payment method, transaction statements and IDs and your billing address. We do not collect or store your full credit or debit card details (which are processed by a payment service provider who is a separate controller of your data. Please refer to your payment service provider’s privacy notice for further details on their data collection practices). | Directly from you · Indirectly from you · Third parties |
| Uploaded Content — content that you upload onto our Website or App (e.g. images, videos, text) including profile data like profile photo and bio description, and when sharing content as part of the socialisation functions on the Website and App including forum posts and comments. | Directly from you · Indirectly from you |
| Communications Data — such as your feedback on our services or the performance of our Website or App and other communications with us, including any queries, reports or complaints you raise. This will include information as to how you contact customer services, the channel of communication that you use and any information that you send to us and call logs if you contact us by phone. | Directly from you · Indirectly from you · Third parties |
| Advertising and Marketing Data — such as your interests based on your use of our Website and App and other websites and online services, your survey responses, preferences in relation to receiving marketing materials from us, communication preferences, your preferences for particular services and your subscription details. | Directly from you · Indirectly from you · Third parties |
| Device Data — collected from (or as a result of your using) your device including your IP address, your ISP, and the browser you use to visit our Website or the app platform from which you download our App, device type, unique device identification numbers or other identifiers including advertising identifiers. | Indirectly from you |
| Usage Data — such as activity and webpage and app interaction, page views and searches, log-in information, clicks, operating system, length of visits to certain pages, length of Website and App use and other functional information on Website and App performance (for example, application version information, diagnostics, and crash logs). | Indirectly from you |
| Location Data — collected using WiFi access points and/or GPS from which we can identify your precise geographic location, e.g., technical information that associates your location to your use of the Website or App. | Indirectly from you |
We do not collect any sensitive personal data about you, such as health-related information or information about your race or ethnicity, or sexual orientation.
↑ Back to topHow we use your personal data (our purposes) and our legal basis for processing it
We use the personal data that we collect from and about you only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time we collect your information. Depending on our purpose for collecting your information, we rely on one of the following legal bases:
- Contract — we require certain personal data in order to provide the goods and support the services you purchase or request from us;
- Consent — in certain circumstances, we may ask for your consent (separately from any contract between us) before we collect, use, or disclose your personal data, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you;
- Legitimate interests — we will use or disclose your personal data for the legitimate interests of either HWBT or a third party, but only when we are confident that your privacy rights will remain appropriately protected. Where we require your data to pursue our legitimate interests or the legitimate interests of a third party, it will be in a way which is reasonable for you to expect as part of the running of our business, and which does not materially affect your rights and freedoms. We have identified below what our legitimate interests are; or
- Legal obligation — there are instances where we must process and retain your personal data to comply with laws or to fulfil certain legal obligations.
The following table provides more details on our purposes for processing your personal data and the related legal bases. The legal basis under which your personal data is processed will depend on the data concerned and the specific context in which we use it.
| Purpose / activity | Type of personal data | Legal basis |
|---|---|---|
| Register your account, to manage and administer your account, to facilitate purchases you make. | Identity and Contact Data, Account Data, Transaction Data, Communication Data, Competition and Participation Data, Wallet and Token Data | Performance of a contract with you. |
| Provide and deliver the services including verify eligibility for competitions and prize draws, to process and administer entries, select and notify winners, arrange delivery or collection of prizes and maintain records relating to competitions and prize draws. | Identity and Contact Data, Account Data, Communication Data, Transaction Data, Location Data, Competition and Participation Data, Wallet and Token Data | Performance of a contract with you. Consent (in the case of processing of Location Data). |
| Enable users to create profiles, upload content, publish posts and comments, and otherwise interact with other users through the Website and App. | Identity and Contact Data, Account Data, Profile Data, Communications Data, Uploaded Content Data, Device Data, Usage Data | Performance of a contract with you. Otherwise, as necessary for our legitimate interests (to operate and provide our business, including our Website and App, and to enable users to interact with each other through the Website and App). |
| Process transactions and transaction fee recovery. | Identity and Contact Data, Account Data, Communication Data, Transaction Data, Wallet and Token Data | Performance of a contract with you. |
| Respond to your communications regarding our services, send you service updates, confirmations, technical notices, security alerts, support and administrator messages, respond to your enquiries, requests or complaints. | Identity and Contact Data, Account Data, Transaction Data, Communication Data, Uploaded Content, Device Data, Usage Data | Performance of a contract with you. Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you) — where our communications are not necessary to perform or enter into a contract with you. |
| Reviewing communications with you for customer support and quality assurance and training purposes, and related recordkeeping. | Identity and Contact Data, Account Data, Transaction Data, Communications Data, Uploaded Content, Device Data, Usage Data, Competition and Participation Data, Wallet and Token Data | Necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you) — where our communications are not necessary to perform or enter into a contract with you. |
| Keep our business, including our Website and App, and our employees, users and vendors, and address threats to their safety or the safety of others; to detect and prevent fraud. For example, online we use malware and spyware monitoring tools to detect suspicious activity and algorithms to detect unauthorised access. | Identity and Contact Data, Account Data, Transaction Data, Device Data, Usage Data, Communications Data, Location Data, Competition and Participation Data, Wallet and Token Data | Necessary for our and our third parties' legitimate interests (to operate and provide our business, including our Website and App; to detect or prevent illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure, and the safety and security of our employees, users and vendors). |
| Manage compliance with our terms of service and related internal reporting. | Identity and Contact Data, Account Data, Communications Data, Transaction Data, Uploaded Content, Competition and Participation Data, Winner and Promotional Data, Wallet and Token Data | Performance of a contract with you. Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business, including our Website and App; to detect or prevent illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure, and the safety and security of our employees, users and vendors). Legal obligations. |
| Monitor, investigate and take action in relation to content, communications and behaviour that may breach our terms of service, infringe third-party rights, be unlawful, harmful or fraudulent, or otherwise compromise the safety, security or integrity of our Website and App. | Identity and Contact Data, Account Data, Competition and Participation Data, Wallet and Token Data, Transaction Data, Uploaded Content, Communications Data, Device Data, Usage Data, Location Data | Performance of a contract with you. Necessary for our legitimate interests (to enforce our terms, investigate and respond to misuse of the Website and App, moderate content and communications, protect users, detect and prevent fraud and unlawful activity, and maintain the safety, security and integrity of our Website and App). Legal obligations, where applicable. |
| Administer and maintain our Website and App and our IT systems (including monitoring, troubleshooting, data analysis, testing, system maintenance, repair and support, reporting and hosting of data). | Identity and Contact Data, Account Data, Device Data, Usage Data | Our and our third parties' legitimate interests (to operate, provide and improve our business, including our Website and App; to detect or prevent illegal activities (e.g. fraud) and/or to manage the security of our IT infrastructure). |
| Manage our use of tracking technologies such as cookies and analyse collected data to learn about our Website and App, to improve our Website and App, and to develop new products and services. | Account Data, Device Data, Usage Data, Location Data, Advertising and Marketing Data, Communications Data, Competition and Participation Data, Wallet and Token Data | Consent (where required under applicable law). Otherwise (for strictly necessary cookies) our legitimate interests to operate, provide and improve our business, including our Website and App, to improve our Website and App or use the insights to improve or develop marketing activities and promote our services. |
| Analyse data including metrics related to consumer transactions and behaviour (online and offline), to assess trends and the effectiveness of our advertising and marketing campaigns, to help us understand your needs and provide you with better service and offers, to drive user engagement, promote our brand, and inform other business decisions by understanding consumer behaviour. | Account Data, Transaction Data, Device Data, Usage Data, Communications Data, Advertising and Marketing Data, Competition and Participation Data, Wallet and Token Data | Consent (where required under applicable law). Otherwise, our legitimate interests (to operate, provide and improve our business, including our Website and App, to improve our Website and App or use the insights to improve or develop marketing activities and promote our services). |
| Announce and promote competition winners, including publishing winner information where required or permitted by law or the applicable competition rules, and creating and using promotional materials featuring winners. | Identity and Contact Data, Account Data, Competition and Participation Data, Winner and Promotional Data, Uploaded Content, Communications Data | Performance of a contract with you, where processing is necessary to administer the relevant competition and announce winners in accordance with the applicable competition rules. Necessary for our legitimate interests (to publish winner information, demonstrate that competitions have been fairly administered, promote our competitions and produce promotional materials relating to our competitions). Consent, where required under applicable law or where we ask for your consent to use photographs, images, audio recordings, video recordings, interviews, statements or other promotional content featuring you. |
| Contact current and prospective users (including Website and App visitors) about promotions, competitions and events we think may be of interest, including our newsletter and other promotional mailers and electronic communications. | Account Data, Usage Data, Advertising and Marketing Data, Communication Data, Uploaded Content Data, Competition and Participation Data, Winner and Promotional Data | Consent (where required under applicable law). Otherwise, our legitimate interests (to operate, provide and improve our business; to communicate with you and to develop marketing activities and promote our products and services). |
| Personalise, target, and deliver advertising for our services on third party websites, apps, and other online services (including to identify audiences and individuals like you to better tailor our marketing campaigns and communications), and measure the effectiveness of our campaigns and adjust our methods. | Account Data, Advertising and Marketing Data, Usage Data, Device Data, Competition and Participation Data | Consent (where required under applicable law). Otherwise, our legitimate interests (to improve our business, to promote our services and to use the insights to improve or develop our marketing activities). |
| Analyse social media performance metrics to evaluate and execute social media campaigns, including to interact with our current and prospective users on various social media channels to promote our products, run contests and promotions, answer questions and otherwise drive and monitor user engagement and satisfaction. | Account Data, Advertising and Marketing Data, Communication Data, Uploaded Content Data, Usage Data, Device Data, Competition and Participation Data | Consent (where required under applicable law). Otherwise, our legitimate interests (to improve our business, to promote our services and to use the insights to improve or develop marketing activities). |
| Comply with legal and regulatory obligations to which we are subject, including our obligations to respond to your requests under data protection law. | Identity and Contact Data, Account Data, Transaction Data, Usage Data, Location Data, Communication Data, Uploaded Content Data, Competition and Participation Data, Winner and Promotional Data, Wallet and Token Data | Legal obligation. |
| Protect our legal rights (including where necessary, to share information with law enforcement and others), for example to defend claims against us and to conduct litigation to defend our interests. | Identity and Contact Data, Account Data, Transaction Data, Location Data, Usage Data, Communication Data, Competition and Participation Data, Wallet and Token Data | Our legitimate interests to protect our business interests. |
How we keep your personal data secure
We use appropriate technical and organisational measures to protect the personal data that we collect and process about you. The measures are designed to provide a level of security appropriate to the risk of processing. Specific measures we use include encrypting your personal data in transit and at rest; using an industry standard framework as part of any information security programme; employing advance malware protections; implementation of other reasonable security defences (including vulnerability management, access management and recovery/resilience measures).
Where you have created an account with us that uses a unique password to enable you to access our Website and App, it is your responsibility to keep this password secure and confidential.
↑ Back to topInternational data transfers
In some cases, where your personal data is transferred to third parties, it is processed in countries outside of the EEA and the UK. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).
Specifically, our Website and App servers are located in Ireland. Our third party service providers and partners operate around the world. This means that when we collect your personal data we will process it in any of these countries.
Where we transfer your personal data to countries or organisations outside of the EEA or the UK which have been formally recognised as providing an adequate level of protection for personal data, we rely on the relevant “adequacy decisions” from the European Commission and “adequacy regulations” from the Secretary of State in the UK. We transfer personal data from the EEA and the UK to different countries in reliance on the European Commission's adequacy decision and the Secretary of State's adequacy regulations.
Where the transfer is not subject to an adequacy decision or regulations, we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice and applicable laws. The safeguards we use to transfer personal data are the European Commission's Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) and the UK International Data Transfer Agreement permitted under Article 46(2) of the UK GDPR for the transfer of data originating in the UK.
If you would like further information about data transferred outside the EEA and the UK, please contact us (see ‘How to contact us’ below).
↑ Back to topData retention
We will not keep your personal data for longer than we need it for the purpose for which it is used (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). Details of retention periods for different aspects of your personal data are available from us on request by contacting us using the contact details provided under the ‘How to contact us’ section below.
↑ Back to topYour data protection rights
Individuals located in the UK and EEA have the following data protection rights. To exercise any of them see specific instructions below or contact us using the contact details provided under the ‘How to contact us’ section below.
- You may access, correct, update or request deletion of your personal data.
- You can object to processing of your personal data, ask us to restrict processing of your personal data or request portability of your personal data (i.e. your data to be transferred in a readable and standardised format).
- You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided under the ‘How to contact us’ section below. If you choose to opt out of marketing communications, we will still send you non-promotional emails, such as emails about your account or our ongoing business relations.
- If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time by using the contact details provided under the ‘How to contact us’ section below. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.
- You have the right to complain to a supervisory authority about our collection and use of your personal data. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in Europe are available here and for the UK here. Certain supervisory authorities will require that you exhaust our own internal complaints process before looking into your complaint.
Individuals also have a right to complain about how we have used or handled your personal data. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
↑ Back to topUpdates to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, regulatory, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.
You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.
↑ Back to topHow to contact us
If you have any questions or concerns about our use of your personal data, please contact us at support@hwbtplus.com and where applicable, contact our representative in the EU.
The data controller of your personal data is HWBT Plus LTD (with company no. 17120045) whose registered address is at Lumaneri House Blythe Gate, Blythe Valley Park, Solihull, West Midlands, United Kingdom, B90 8AH.
↑ Back to top